laitimes

Who's making cyber hotspots? The industrial chain behind the doxxing "hot search list" →

author:Ping An Han Yin

Rumors and drainage, paid deletion of posts, and brushing volume control comments, all of these illegal behaviors have the shadow of "Internet water army". Not long ago, the police in Xinxiang, Henan Province destroyed a large "Internet water army" criminal gang with a large number of "Internet celebrities" and "big V" accounts, and this criminal gang also used special control software to implement batch forwarding, likes, and comments, and one person could operate hundreds of accounts.

In May 2023, the police in Xinxiang, Henan Province inspected the Internet and found that a large number of Weibo accounts were extremely active, frequently and synchronously released promotional advertisements, and publicized the so-called influence, channels and resource advantages of their team, claiming that through their platform, they could help customers greatly increase the number of views, increase the popularity of online accounts, and even rush the online materials provided by customers to the Weibo hot search list according to the needs of customers.

Wang Zheng, police officer of the Internet Technology Detachment of the Xinxiang Public Security Bureau: We feel that there is a certain problem with this platform, because it has a large number of social media accounts, and these accounts must be real-name in the first place, and we suspect that this platform may be suspected of violating citizens' personal privacy, so we launched an investigation into this platform.

Who's making cyber hotspots? The industrial chain behind the doxxing "hot search list" →

Subsequently, the police chatted with the platform's customer service as a customer. According to the platform's customer service, the company has a lot of real-use "Internet celebrity" and "big V" accounts, as well as a large number of ordinary Weibo accounts, which can fry the content specified by customers on the hot search. For example, this topic called "Post-00s would rather set up a stall than go to work" was promoted by them and quickly topped the hot search list in a short period of time.

Wang Zheng, police officer of the Internet Technology Detachment of Xinxiang Public Security Bureau: We browse this website, it is like a shopping mall, there are various items, which can be purchased at different prices, including real people like and machine brush likes, the price of real people like is 1 cent a like, and the machine brush like is 3 cents a like.

Who's making cyber hotspots? The industrial chain behind the doxxing "hot search list" →

According to the platform's customer service, if you want to quickly stir up the topic, you must attract enough attention and get topic traffic through a large number of forwards, likes, and comments. The police judged that Weibo accounts are all real-name authentication, and if the company uses illegal means to manipulate a large number of Weibo accounts to forward, like, and comment, it is very likely that it has been suspected of illegal business operations, and it is not the crime of violating personal privacy as previously suspected.

Wang Zheng, police officer of the Internet Technology Detachment of the Xinxiang Public Security Bureau: We checked the domain name and the background server, and in the background server data, we found that an account was quite active and undertook 50% of the workload of the platform, and then we worked on this account and found that this account was used by Wei Hui Zhang.

Who's making cyber hotspots? The industrial chain behind the doxxing "hot search list" →

The investigation found that Zhang had a studio in Weihui City, which may be the place where Zhang brushed data, and then the police inspected Zhang's studio, and sure enough, there were major discoveries.

Wang Zheng, police officer of the Internet Technology Detachment of the Xinxiang City Public Security Bureau: I found that Zhang's studio has 10 computers, and a large number of mobile phone simulators are logged on each computer. At that time, we found at the scene that this "Thousand Languages Central Control" software was automatically liking, commenting, and forwarding a certain Weibo account in batches.

Who's making cyber hotspots? The industrial chain behind the doxxing "hot search list" →

After an investigation at the scene, the police found that there were about 50 mobile phone simulators on each computer, and 10 computers were equivalent to controlling about 500 Weibo accounts. Subsequently, the police launched a further investigation around Zhang.

Start with "brushing your hands".

Follow the vine to find out the links of the chain

As an online swiper, after receiving the task, Zhang will forward and like the specified topic according to the online instructions. So, who is his upline? Starting from the "brushing hands", the police followed the vine and investigated all links of the entire chain.

Zhang confessed that his upline is a cultural media Co., Ltd. in Henan, in addition to hiring network brushers to forward, like, and comment, it has also developed central control software for batch forwarding. At the beginning, Zhang just forwarded, liked, and commented according to the company's instructions, but this income was minimal, in order to increase his income, he purchased the company's central control software, and began to forward, like, and comment in batches.

Who's making cyber hotspots? The industrial chain behind the doxxing "hot search list" →

As the investigation deepened, the police found that there are still many online swipers like Zhang across the country, and there are thousands of online "swipers" recruited by this so-called cultural media company across the country.

Wang Zheng, police officer of the Internet Technology Detachment of the Xinxiang Municipal Public Security Bureau: If it is calculated according to the fact that Zhang Mou controls 500 Weibo accounts, the false traffic of likes and comments created by this company in a day can reach more than 10 million times, which is still a large amount.

Who's making cyber hotspots? The industrial chain behind the doxxing "hot search list" →

Through the analysis of the capital flow of this cultural media company, two Internet companies with which it has a large amount of capital transactions surfaced, one in Xiamen and the other in Tianjin. Although they are thousands of miles apart, these two network companies have the same characteristics, and they both have some online big V accounts, which range from hundreds of thousands of fans to millions of fans, and both have a certain influence on the Internet.

By sorting out the criminal chain of this case, the police gradually became clear about their modus operandi. For example, if an Internet brand needs to promote a project, the brand will contact these network companies that have big V accounts, and the promotion cost is often hundreds of thousands or hundreds of thousands. And the higher the ranking in the promotion process, the longer it lasts, and the more expensive it is, and then it is signed in the form of an advertising contract.

After that, these network companies break down the task at a fixed price and package it to these downstream cultural media companies, and push the content required by the brand to the hot search and attract attention through batch forwarding, liking, and commenting.

Who's making cyber hotspots? The industrial chain behind the doxxing "hot search list" →

Under normal circumstances, these online companies will first provide hot search plans for brands, set up relevant topics, and then manipulate the topics to stir up hot searches. In this process, they use the big V account in their hands to publish topics combined with the project and carry out traceless advertising placement. Finally, they will also detonate the topic by publishing topics without commercial content, so as to achieve topic ranking.

Destroy the chain and capture 276 people in various places

The police investigation found that this "Internet water army" gang was involved in hundreds of millions of false Weibo retweets, likes, and comments, including social hot events, celebrity hype, advertising drainage and many other fields. After grasping the relevant criminal facts, the police carried out a network collection operation, successively arrested 276 criminal suspects in Henan, Fujian, Shanghai and other places, and uncovered the details of the illegal profits of the companies involved.

In recent years, a large number of topic promotion activities with commercial purposes have been carried out on online platforms. In these topic promotion activities, some Internet companies have smelled the so-called "business opportunities" and began to organize the use of a large number of Internet water armies to forward, like, and comment on designated topics, and then carry out traceless advertising placement in order to seek huge benefits. According to the police, from January to May 2023, the online company in Xiamen made illegal profits of nearly 12 million yuan in just a few months.

Who's making cyber hotspots? The industrial chain behind the doxxing "hot search list" →

According to the police investigation, in the entire chain of interests, Internet swipers like the criminal suspect Zhang are at the bottom, and in order to expand the so-called "business volume", the higher-level network companies will hire as many Internet swipers as possible like Zhang, so they will publish very tempting recruitment information on the Internet.

The police investigation found that this "Internet water army" criminal gang was engaged in more than 160 million fake Weibo traffic links, involving more than 800 million false Weibo forwards, likes, and comments, including social hot events, celebrity hype, advertising drainage, account raising and attracting fans and many other fields.

An Junsheng, head of the criminal investigation detachment of the Xinxiang City Public Security Bureau: Up to now, we have taken criminal coercive measures against 94 people, transferred 19 people for prosecution, sentenced 7 people, eliminated 6 online troll companies, and seized 4 destructive software that automatically transferred comments and likes in batches.

Who's making cyber hotspots? The industrial chain behind the doxxing "hot search list" →

According to the police, the average age of the suspects arrested in the case is in their twenties, and even some suspects do not know that they have violated the law after being arrested.

An Junsheng, head of the Criminal Investigation Detachment of the Xinxiang Public Security Bureau: This boundary issue mainly lies in whether to provide or buy fictitious services such as comments, likes, forwards, and followers to others for a fee, and whether to publish false information on the Internet, hype up false traffic, and artificially create hot searches. There is also whether advertising revenue and traffic revenue are obtained in an illegal way.

"Brushing order control evaluation" provides paid services for platform merchants

In addition to false momentum, artificially creating hot searches, and earning high promotion fees, some companies involved in the case have targeted online shopping platforms, acting as "Internet water army" through downstream buyers, maliciously brushing positive and bad reviews, and profiting from illegal acts.

In February this year, the police in Litong District, Wuzhong City, Ningxia Province found that a network technology company in the jurisdiction had illegal services such as providing paid swiping orders and deleting bad reviews, and was suspected of illegal operation. When the police handling the case first touched the row, the various deeds of the company involved in the case revealed suspiciousness.

During the investigation, the police handling the case saw that in the 40-square-meter simple office area set up in the rental house, there were 7 to 8 staff members working through mobile phones and computers. After many investigations, the police found that the company involved in the case was engaged in online sales services at the beginning of its establishment, but it slowly changed its taste.

Xu Hexian, police officer of the Economic Investigation Brigade of the Litong District Bureau of the Wuzhong Public Security Bureau: Their company was registered in 2020, and at first it provided online sales services, but later swiped orders or bad reviews and praise on the Internet, and services with illegal acts became their main business.

Who's making cyber hotspots? The industrial chain behind the doxxing "hot search list" →

Different from traditional forms of illegal crimes, the gang not only has a clear structure and a clear division of labor, but also breaks through the regional, time-space restrictions of traditional crimes in the entire criminal chain and space. In the face of such a situation, the synchronous control of key members and evidence during the arrest is particularly important.

Xu Hexian, police officer of the Economic Investigation Brigade of the Litong District Bureau of the Wuzhong City Public Security Bureau: After we went to the scene, we immediately took all the staff involved in the case from their workstations to prevent them from contacting upstream and downstream and damaging electronic equipment and data.

Who's making cyber hotspots? The industrial chain behind the doxxing "hot search list" →

After a series of meticulous investigations, the facts of the violation gradually became clear, and a case of illegal operation of an "Internet water army" headed by Ma gradually surfaced. As the operator, Ma undertook the entrustment of "brushing reviews and brushing orders" online and then issued the task of "brushing orders and controlling reviews", and the company's employees took orders, looking for downstream buyers to act as "online water army", allowing them to enter specific stores to buy specific products, give good or bad reviews to products, and get corresponding remuneration after being confirmed by the seller.

Li Bo, Captain of the Economic Investigation Brigade of the Litong District Bureau of the Wuzhong City Public Security Bureau: This behavior disrupts the normal social market order and is not allowed by law. If you make a profit through the above-mentioned illegal acts, it is basically a fact that constitutes a violation of the law and the crime.

In the face of a complete chain of evidence, the relevant persons involved in the case, led by Ma, confessed to the facts of the violation and crime. At present, the company involved in the case has been seized in accordance with the law, and the case is under further investigation.

Source: Capital Internet Police

Read on